FKIE_CVE-2024-3544

Vulnerability from fkie_nvd - Published: 2024-05-02 15:15 - Updated: 2025-02-03 21:38
Severity ?
7.5 (High) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.
References
security@progress.comhttps://kemptechnologies.com/Product
security@progress.comhttps://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543Product
af854a3a-2127-422b-91ae-364da2661108https://kemptechnologies.com/Product
af854a3a-2127-422b-91ae-364da2661108https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543Product
Impacted products
Vendor Product Version
progress loadmaster *
progress loadmaster *
progress loadmaster *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:lts:*:*:*",
              "matchCriteriaId": "D221FAEA-7441-4868-899E-9FE12D88DD95",
              "versionEndExcluding": "7.2.48.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*",
              "matchCriteriaId": "71C25CAF-73A9-4F9A-9914-ABCFB0C9D4BE",
              "versionEndExcluding": "7.2.54.10",
              "versionStartIncluding": "7.2.49.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*",
              "matchCriteriaId": "651AEE76-E95B-4E43-86E6-190062B23FE7",
              "versionEndExcluding": "7.2.59.4",
              "versionStartIncluding": "7.2.55.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nUnauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.\n\n"
    },
    {
      "lang": "es",
      "value": "Los atacantes no autenticados pueden realizar acciones utilizando claves privadas SSH conociendo la direcci\u00f3n IP y teniendo acceso a la misma red de una de las m\u00e1quinas del grupo HA o Cluster. Esta vulnerabilidad se ha solucionado mejorando las comunicaciones con los socios de LoadMaster para requerir un secreto compartido que debe intercambiarse entre los socios antes de que pueda continuar la comunicaci\u00f3n."
    }
  ],
  "id": "CVE-2024-3544",
  "lastModified": "2025-02-03T21:38:22.117",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "security@progress.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-05-02T15:15:07.053",
  "references": [
    {
      "source": "security@progress.com",
      "tags": [
        "Product"
      ],
      "url": "https://kemptechnologies.com/"
    },
    {
      "source": "security@progress.com",
      "tags": [
        "Product"
      ],
      "url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://kemptechnologies.com/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543"
    }
  ],
  "sourceIdentifier": "security@progress.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "security@progress.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.